CVE-2026-102101

8.1 HIGHpublic exploit available

Published 2026-09-30 · Updated 2026-10-01

AI risk analysis

Summary: The flaw is a deserialization vulnerability in Kiteworks Core before version 9.5.0, which could allow remote code execution if an attacker can influence the data being deserialized.
Exploitability: Exploitation requires an attacker to influence the data, making it somewhat difficult but not impossible.
Blast radius: If exploited, this could result in remote code execution on the appliance, potentially leading to full system compromise.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Kiteworks Core 9.5.0 or later.

rcedeserializationremote-code-execution

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on its own.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-502

Public exploit & PoC references

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-x5hx-fgrp-prvf

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.